DNS issues on 2003 network

coliver

@wirestyle22 said in DNS issues on 2003 network:

@thwr said in DNS issues on 2003 network:

@wirestyle22 said in DNS issues on 2003 network:

@coliver said in DNS issues on 2003 network:

@wirestyle22 said in DNS issues on 2003 network:

@thwr said in DNS issues on 2003 network:

netstat -an | findstr /I "udp" | findstr "53"

The only machines that aren't working are the file server and print server. Everything else connected correctly. Am I doing this on the domain controller or problem server?

On the problem server check and see if there are static DNS servers defined. That would be my guess.

The IP's are correct

Erm, is the .16 a DNS? Same host?

.16 is DNS. It's the domain controller

Good to know. How about the configuration of the problem servers.

wirestyle22

@BRRABill said in DNS issues on 2003 network:

@wirestyle22

Can you post the TCP/IP settings from the machine you are having an issue with?

File Server

Print Server

coliver

@wirestyle22 said in DNS issues on 2003 network:

@BRRABill said in DNS issues on 2003 network:

@wirestyle22

Can you post the TCP/IP settings from the machine you are having an issue with?

File Server

Print Server

Need the DNS data ipconfig /all or go through the details pane like you did previously.

BRRABill

@wirestyle22

Sorry, I mean the same screenshot as you posted for the DC.

thwr

At least everything is on the same subnet... to sum up:

You can ping the .16 from .23 and .36 and vice-versa
You can not use "nslookup somehostname 192.168.10.16"

wirestyle22

Print Server

0_1473433462244_print server.jpg

File Server

0_1473433470902_file server.jpg

wirestyle22

@thwr said in DNS issues on 2003 network:

At least everything is on the same subnet... to sum up:

You can ping the .16 from .23 and .36 and vice-versa

You can not use "nslookup somehostname 192.168.10.16"

I can't nslookup from .23 or .36, .16 is my domain controller.

Can't ping .16 from either

BRRABill

@wirestyle22 said in DNS issues on 2003 network:

@thwr said in DNS issues on 2003 network:

At least everything is on the same subnet... to sum up:

You can ping the .16 from .23 and .36 and vice-versa

You can not use "nslookup somehostname 192.168.10.16"

I can't nslookup from .23 or .36, .16 is my domain controller

And you CAN nslookup from everything else? Like the DC itself or your PC?

thwr

@wirestyle22 said in DNS issues on 2003 network:

@thwr said in DNS issues on 2003 network:

At least everything is on the same subnet... to sum up:

You can ping the .16 from .23 and .36 and vice-versa

You can not use "nslookup somehostname 192.168.10.16"

I can't nslookup from .23 or .36, .16 is my domain controller

Could you just try the following from your fileserver please?

nslookup printserver 192.168.10.16

And, just coming to mind: Are there A-records for your file- and printserver in your primary forward lookup zone?

wirestyle22

@BRRABill said in DNS issues on 2003 network:

@wirestyle22 said in DNS issues on 2003 network:

@thwr said in DNS issues on 2003 network:

At least everything is on the same subnet... to sum up:

You can ping the .16 from .23 and .36 and vice-versa

You can not use "nslookup somehostname 192.168.10.16"

I can't nslookup from .23 or .36, .16 is my domain controller

And you CAN nslookup from everything else? Like the DC itself or your PC?

Yes

wirestyle22

@thwr said in DNS issues on 2003 network:

@wirestyle22 said in DNS issues on 2003 network:

@thwr said in DNS issues on 2003 network:

At least everything is on the same subnet... to sum up:

You can ping the .16 from .23 and .36 and vice-versa

You can not use "nslookup somehostname 192.168.10.16"

I can't nslookup from .23 or .36, .16 is my domain controller

Could you just try the following from your fileserver please?
nslookup printserver 192.168.10.16
And, just coming to mind: Are there A-records for your file- and printserver in your primary forward lookup zone?

thwr

@wirestyle22 said in DNS issues on 2003 network:

@thwr said in DNS issues on 2003 network:
@wirestyle22 said in DNS issues on 2003 network:

@thwr said in DNS issues on 2003 network:

At least everything is on the same subnet... to sum up:

You can ping the .16 from .23 and .36 and vice-versa

You can not use "nslookup somehostname 192.168.10.16"

I can't nslookup from .23 or .36, .16 is my domain controller

Could you just try the following from your fileserver please?
nslookup printserver 192.168.10.16
And, just coming to mind: Are there A-records for your file- and printserver in your primary forward lookup zone?

What about asking your second DC/DNS?

nslookup printserver 192.168.10.55

wirestyle22

@thwr said in DNS issues on 2003 network:

@wirestyle22 said in DNS issues on 2003 network:
@thwr said in DNS issues on 2003 network:
@wirestyle22 said in DNS issues on 2003 network:

@thwr said in DNS issues on 2003 network:

At least everything is on the same subnet... to sum up:

You can ping the .16 from .23 and .36 and vice-versa

You can not use "nslookup somehostname 192.168.10.16"

I can't nslookup from .23 or .36, .16 is my domain controller

Could you just try the following from your fileserver please?
nslookup printserver 192.168.10.16
And, just coming to mind: Are there A-records for your file- and printserver in your primary forward lookup zone?
What about asking your second DC/DNS?
nslookup printserver 192.168.10.55 

Same error

thwr

Weird. And what about

nslookup www.cnn.com 8.8.8.8

from your print- or fileserver?

Should look like this:

nslookup www.cnn.com 8.8.8.8
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

Nicht autorisierende Antwort:
Name:    prod.turner.map.fastlylb.net
Address:  151.101.36.73
Aliases:  www.cnn.com
          turner.map.fastly.net

wirestyle22

@thwr said in DNS issues on 2003 network:

Weird. And what about

nslookup www.cnn.com 8.8.8.8

from your print- or fileserver?

Should look like this:

nslookup www.cnn.com 8.8.8.8
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

Nicht autorisierende Antwort:
Name:    prod.turner.map.fastlylb.net
Address:  151.101.36.73
Aliases:  www.cnn.com
          turner.map.fastly.net

Received the same error. This is from the file server. I will try the print server

thwr

@wirestyle22 said in DNS issues on 2003 network:

@thwr said in DNS issues on 2003 network:
Weird. And what about
nslookup www.cnn.com 8.8.8.8
from your print- or fileserver?

Should look like this:
nslookup www.cnn.com 8.8.8.8
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

Nicht autorisierende Antwort:
Name:    prod.turner.map.fastlylb.net
Address:  151.101.36.73
Aliases:  www.cnn.com
          turner.map.fastly.net
Received the same error.

Any firewall in between? Some local AV with firewall included?

wirestyle22

@thwr said in DNS issues on 2003 network:

@wirestyle22 said in DNS issues on 2003 network:
@thwr said in DNS issues on 2003 network:
Weird. And what about
nslookup www.cnn.com 8.8.8.8
from your print- or fileserver?

Should look like this:
nslookup www.cnn.com 8.8.8.8
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

Nicht autorisierende Antwort:
Name:    prod.turner.map.fastlylb.net
Address:  151.101.36.73
Aliases:  www.cnn.com
          turner.map.fastly.net
Received the same error.
Any firewall in between? Some local AV with firewall included?

We use Symantec endpoint protection, but can It really be that? Based on yesterday I can't think of anything that would cause any of those settings to change

wirestyle22

@thwr said in DNS issues on 2003 network:

Weird. And what about

nslookup www.cnn.com 8.8.8.8

from your print- or fileserver?

Should look like this:

nslookup www.cnn.com 8.8.8.8
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

Nicht autorisierende Antwort:
Name:    prod.turner.map.fastlylb.net
Address:  151.101.36.73
Aliases:  www.cnn.com
          turner.map.fastly.net

Print server says DNS request timed out.

scottalanmiller

@wirestyle22 said in DNS issues on 2003 network:

@thwr said in DNS issues on 2003 network:
@wirestyle22 said in DNS issues on 2003 network:
@thwr said in DNS issues on 2003 network:
Weird. And what about
nslookup www.cnn.com 8.8.8.8
from your print- or fileserver?

Should look like this:
nslookup www.cnn.com 8.8.8.8
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

Nicht autorisierende Antwort:
Name:    prod.turner.map.fastlylb.net
Address:  151.101.36.73
Aliases:  www.cnn.com
          turner.map.fastly.net
Received the same error.
Any firewall in between? Some local AV with firewall included?
We use Symantec endpoint protection, but can It really be that? Based on yesterday I can't think of anything that would cause any of those settings to change

Of course it can be that! That product is downright famous for doing stuff like this. That should have been mentioned immediately. Is that the problem here? Less than likely. Is it a possibility? Certainly.

You should get that removed, although it's difficult to remove and that's why it is sometimes classified as malware. You would be better off running with the OS' own AV than that. But of course, something like Webroot or Cylance would be far better still. But SEP... not a viable option IMHO.

scottalanmiller

Could it be a firewall with UDP throttling on and these machines are just getting caught at random?